basic modules

modules/networking/core/default.nix

@@ -0,0 +1,28 @@
+{ ... }:
+
+{
+  imports = [
+    ./firewall.nix
+  ];
+
+  networking = {
+    hostName = "laptop";
+    networkmanager.enable = true;
+  };
+
+  services.resolved = {
+    enable = true;
+    dnssec = "true";
+    domains = [ "~." ];
+    fallbackDns = [
+      "192.168.1.193" # Pi-hole
+      "1.1.1.1" # Cloudflare
+      "1.0.0.1" # Cloudflare (Secondary)
+    ];
+    extraConfig = ''
+      DNSOverTLS=yes
+    '';
+  };
+
+  networking.nftables.enable = true;
+}

modules/networking/core/firewall.nix

@@ -0,0 +1,17 @@
+{ ... }:
+
+{
+  networking.firewall = {
+    enable = true;
+
+    allowPing = true;
+
+    allowedTCPPorts = [
+      22
+      80
+    ];
+    allowedUDPPorts = [
+      53
+    ];
+  };
+}

modules/networking/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+
+{
+  imports = [
+    ./core
+    ./tailscale.nix
+    ./wireguard.nix
+  ];
+}

modules/networking/tailscale.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+{
+  services.tailscale.enable = true;
+  networking.firewall = {
+    trustedInterfaces = [ config.services.tailscale.interfaceName ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+
+  systemd.services.tailscaled.serviceConfig.Environment = [
+    "TS_DEBUG_FIREWALL_MODE=nftables"
+  ];
+
+  systemd.network.wait-online.enable = false;
+  boot.initrd.systemd.network.wait-online.enable = false;
+}

modules/networking/wireguard.nix

@@ -0,0 +1,22 @@
+{ ... }:
+
+{
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.0.0.2/24" ];
+      privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store!
+
+      peers = [
+        {
+          publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY=";
+          allowedIPs = [ "0.0.0.0/0" ];
+          endpoint = "server.maariz.org:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+
+  # Ensure the Wireguard UDP port is open if you are hosting the server
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+}